lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Kernel Tree For Xiaomi 11 Lite NE 5G
891,150 Commits 1 Branch 0 Tags 1.8 GiB
C 98%
Assembly 1.2%
Makefile 0.3%
Shell 0.2%
Python 0.1%
6bfc5377a2
Go to file
Halil Pasic 6bfc5377a2 swiotlb: fix info leak with DMA_FROM_DEVICE 
commit ddbd89deb7d32b1fbb879f48d68fda1a8ac58e8e upstream.

The problem I'm addressing was discovered by the LTP test covering
cve-2018-1000204.

A short description of what happens follows:
1) The test case issues a command code 00 (TEST UNIT READY) via the SG_IO
   interface with: dxfer_len == 524288, dxdfer_dir == SG_DXFER_FROM_DEV
   and a corresponding dxferp. The peculiar thing about this is that TUR
   is not reading from the device.
2) In sg_start_req() the invocation of blk_rq_map_user() effectively
   bounces the user-space buffer. As if the device was to transfer into
   it. Since commit a45b599ad8 ("scsi: sg: allocate with __GFP_ZERO in
   sg_build_indirect()") we make sure this first bounce buffer is
   allocated with GFP_ZERO.
3) For the rest of the story we keep ignoring that we have a TUR, so the
   device won't touch the buffer we prepare as if the we had a
   DMA_FROM_DEVICE type of situation. My setup uses a virtio-scsi device
   and the  buffer allocated by SG is mapped by the function
   virtqueue_add_split() which uses DMA_FROM_DEVICE for the "in" sgs (here
   scatter-gather and not scsi generics). This mapping involves bouncing
   via the swiotlb (we need swiotlb to do virtio in protected guest like
   s390 Secure Execution, or AMD SEV).
4) When the SCSI TUR is done, we first copy back the content of the second
   (that is swiotlb) bounce buffer (which most likely contains some
   previous IO data), to the first bounce buffer, which contains all
   zeros.  Then we copy back the content of the first bounce buffer to
   the user-space buffer.
5) The test case detects that the buffer, which it zero-initialized,
  ain't all zeros and fails.

One can argue that this is an swiotlb problem, because without swiotlb
we leak all zeros, and the swiotlb should be transparent in a sense that
it does not affect the outcome (if all other participants are well
behaved).

Copying the content of the original buffer into the swiotlb buffer is
the only way I can think of to make swiotlb transparent in such
scenarios. So let's do just that if in doubt, but allow the driver
to tell us that the whole mapped buffer is going to be overwritten,
in which case we can preserve the old behavior and avoid the performance
impact of the extra bounce.

Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-04-15 14:17:55 +02:00
arch nds32: fix access_ok() checks in get/put_user 2022-03-28 08:46:48 +02:00
block block: Fix fsync always failed if once failed 2022-03-08 19:07:47 +01:00
certs
crypto crypto: pcrypt - Delay write to padata->info 2021-11-17 09:48:40 +01:00
Documentation swiotlb: fix info leak with DMA_FROM_DEVICE 2022-04-15 14:17:55 +02:00
drivers tpm: use try_get_ops() in tpm-space.c 2022-03-28 08:46:48 +02:00
fs nfsd: Containerise filecache laundrette 2022-03-28 08:46:43 +02:00
include swiotlb: fix info leak with DMA_FROM_DEVICE 2022-04-15 14:17:55 +02:00
init bpf: Add kconfig knob for disabling unpriv bpf by default 2022-02-16 12:52:49 +01:00
ipc shm: extend forced shm destroy to support objects from several IPC nses 2021-12-01 09:23:35 +01:00
kernel swiotlb: fix info leak with DMA_FROM_DEVICE 2022-04-15 14:17:55 +02:00
lib ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE 2022-03-19 13:40:16 +01:00
LICENSES
mm memfd: fix F_SEAL_WRITE after shmem huge page allocated 2022-03-08 19:07:49 +01:00
net llc: only change llc->dev when bind() succeeds 2022-03-28 08:46:48 +02:00
samples samples/kretprobes: Fix return value if register_kretprobe() failed 2021-11-17 09:48:39 +01:00
scripts kconfig: fix failing to generate auto.conf 2022-02-23 12:00:01 +01:00
security ima: Do not print policy rule with inactive LSM labels 2022-02-16 12:52:47 +01:00
sound ALSA: hda/realtek: Add quirk for ASUS GA402 2022-03-28 08:46:46 +02:00
tools Revert "selftests/bpf: Add test for bpf_timer overwriting crash" 2022-03-23 09:12:08 +01:00
usr
virt KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated 2022-03-19 13:40:15 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.188 2022-03-28 08:46:49 +02:00
README

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.